daafd3ca11c0df8a1307900dba026c43_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

daafd3ca11c0df8a1307900dba026c43_JaffaCakes118
Size

146KB
MD5

daafd3ca11c0df8a1307900dba026c43
SHA1

baa3350c61b868d3b535c96cdac661ca1a46055c
SHA256

41121e856c805f979de2259440087ad31a197ca6428bd261bfb3b5708d5d6e52
SHA512

e010c80a4d3b0fc0c8683207177e668d35fe031c067d1eeb64811087637d50ad93bbbb873ab1f0d9eb04fd60dff276c2d17fcbecc690ec4a040d7770baf36f87
SSDEEP

3072:Vw0r1qFVE0pBtRSRzHyiJmYlP7rCnUvtsrR64MBuA:VepsRWicYd7WnYwdM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
daafd3ca11c0df8a1307900dba026c43_JaffaCakes118

Files

daafd3ca11c0df8a1307900dba026c43_JaffaCakes118
.exe windows:1 windows x86 arch:x86

ff2e6cd6ff2c7d1da266b71e4231354f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualAlloc
GetCommandLineA
VirtualAlloc
FreeConsole
FindNextVolumeMountPointA
SearchPathA
FindFirstChangeNotificationW
ReadConsoleInputA
VirtualAlloc
VirtualAlloc
ResetEvent
GetShortPathNameA
GetVolumeNameForVolumeMountPointA

gdi32

AddFontResourceExW

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 94KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ